Audit Active Dovecot Sessions with doveadm who

doveadm who answers the question you actually have during an incident: who is logged in right now, and from where. You can narrow the result to one username or one network without disconnecting anyone.

Allow about ten minutes. You need shell access to a Dovecot host, the dovecot-core package, and permission to reach Dovecot's administration socket. The examples match the installed Dovecot v2.3 manpage and package version 1:2.3.21+dfsg1-2ubuntu6.5. Your live session list will, of course, look nothing like the one below.

1. Check the installed command

Start with read-only checks. These do not need elevated privileges:

$ command -v doveadm
/usr/bin/doveadm
$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5
$ doveadm help who

The command's synopsis is doveadm who [-1] [-a SOCKET] [USER] [IP[/MASK]]. Its default output formatter is table, and it reports current connections grouped by username unless you ask for one line per user and connection.

2. Run the basic session report

Run the command with no filters. It only inspects state, but it reads the Dovecot administration socket, so a normal login may not be allowed to use it:

$ sudo doveadm who
username                       # proto (pids)        (ips)
jane                           2 imap  (30155 30412) (::1)
[email protected]               1 imap  (30257)       (192.0.2.34)

• First column: username. Several connections for one user can be grouped onto one row.
• Middle: protocol and process IDs.
• End: client addresses.

If you omit sudo and see Permission denied for /run/dovecot/anvil, the command has not produced a session report at all. Retry as an account authorised for the socket, or ask the Dovecot administrator which account and policy are intended; do not weaken socket permissions just to make a diagnostic command work.

3. Filter by client address

Pass an IPv6 address, IPv4 address, or CIDR network as the final argument to reduce the result to matching connections:

$ sudo doveadm who 192.0.2.0/24
username                        # proto (pids)  (ips)
[email protected]                1 imap  (30257) (192.0.2.34)

$ sudo doveadm who ::1
username                       # proto (pids)        (ips)
jane                           2 imap  (30155 30412) (::1)

Use a mask when you mean a network, not one host. IPv4 and IPv6 addresses are accepted in the same position, and an empty result is a valid result: it means no current connection matched the filter, not that Dovecot is down.

4. Filter by username

Put a username or username pattern in the argument position before the optional IP filter:

$ sudo doveadm who 'ja*'
username                    # proto (pids)        (ips)
james                       1 imap  (30091)       (127.0.0.1)
jane                        2 imap  (30155 30412) (::1)

$ sudo doveadm who '[email protected]' 192.0.2.0/24
username                    # proto (pids)  (ips)
[email protected]            1 imap  (30257) (192.0.2.34)

The manpage permits wildcards in the username. Quote a pattern so the shell does not expand it against files in your current directory, since that small quoting detail is a common reason a wildcard appears to return no users. Keep the argument order clear, username first and address second: pass only the network to inspect every user from it, or pass both to find one user on one network.

5. Choose a less ambiguous output format

Use the global -f option before who when another program or a careful review needs a different layout:

$ sudo doveadm -f flow who '[email protected]'
[email protected] proto=imap pids=30257 ips=192.0.2.34

$ sudo doveadm -f tab who
username\t# proto (pids)\t(ips)
jane\t2 imap (30155 30412)\t(::1)

The installed v2.3 manpage documents four formatters: table adjusts columns for people, tab uses tab-separated values, flow prints key and value pairs, and pager puts each key and value on its own line with a form-feed between records. Choose flow or tab when column spacing would make downstream parsing fragile.

6. Show one line for every connection

By default, connections are grouped by username. Add -1 when you need each user and connection on its own line:

$ sudo doveadm who -1 'jane'
username  proto  pid    ip
jane      imap   30155  ::1
jane      imap   30412  ::1

The exact spacing and fields depend on the selected formatter and the running Dovecot instance; treat the header as authoritative. The point of -1 is to stop multiple connections being collapsed into one grouped record.

7. Investigate socket and configuration mismatches

The default local socket is /run/dovecot/anvil. If the host uses a different base_dir, the socket can be elsewhere, so ask the administrator to confirm the effective configuration rather than guessing a path:

$ sudo doveconf -n | grep '^base_dir'
base_dir = /run/dovecot/
$ sudo doveadm who -a /run/dovecot/anvil

This guide changes no persistent configuration and disconnects no sessions, so there is nothing to undo. If a socket path or access policy was changed separately to diagnose the issue, restore its previous value and verify the service before declaring the investigation complete.